Tsuzuku & Sato [1]} showed that convolutional neural networks are sensitive in the direction of Fourier basis functions of the images' decomposition, especially in the context of universally adversarial attacks, and proposed a Fourier based attack method. Investigating trade-offs between Gaussian data augmentation and adversarial training Yin et al. [2]} take a Fourier perspective and observe that adversarial examples are not only a high-frequency phenomenon. In [3]} it is assumed that internal responses of a DNN model follow the generalized Gaussian distribution, both for benign and adversarial examples, but with different parameters. They extract the feature maps at each layer in the classification network and calculate the Benford-Fourier coefficients for all of these representations. A Support Vector Machine is then trained on the concatenation of these.
